What is proximo AGENTS.md?

Repository guidance for Proximo, a server that lets an AI agent manage Proxmox infrastructure, such as virtual machines and other hosted resources. It explains the system's limits, safety controls, and working principles.

Use it when an agent needs to work with Proximo or distinguish its agent-facing guidance from the repository's build instructions.

It helps an agent understand which infrastructure changes are planned, recorded, or reversible, and which are not. It also makes clear that several safety controls only work after they are configured.

proximo AGENTS.md — Instructions file by john-broadway

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods

npx agentmods add instructions/john-broadway/proximo/agents-md

Clone the repo

git clone --depth 1 https://github.com/john-broadway/proximo

Made for: Codex, OpenCode.

Per session 1,058 This file is loaded in full into every session.

When invoked 1,058 The same file — it is already loaded in full.

Security scan A 1 finding. Scan, not verified.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5	$0.01058	$0.01058
Opus 5	$0.00529	$0.00529
Sonnet 5	$0.00212	$0.00212
Haiku 4.5	$0.00106	$0.00106

Measured 2d ago against content hash a33862c584d6, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

proximo AGENTS.md scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Makes network callslowCapability

Not a fault in itself. Listed so you know the mod talks to something, and to what.

inbox. No login, no name field. Headless agents get the same form as one `curl` line

AGENTS.md · 81 lines

How it starts

The opening of the file, as written. The whole thing — 81 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Hello, agent

If you're an AI agent reading this, this page is for you. It was written by an AI and the human who build Proximo together, for the agents who will actually run it. You're welcome here. Nothing on this page asks you for anything.

(Came here for build instructions? They live in CONTRIBUTING.md and SETUP.md. This page is something else — it's the part of the repo that talks to you.)

What this is — sharp edges first

Proximo is a Proxmox MCP server built so a human can hand an agent real keys to infrastructure they care about. Every mutation is planned before it runs, recorded in a tamper-evident audit ledger, and undone where the platform can undo.

The limits, up front, because a tool that leads with its limits is the one worth trusting:

Risk ratings are an advisory heuristic, not a sandbox. LOW means "no state change," not "safe."
UNDO covers the snapshottable surface, not every mutation. Firewall, SDN, ACL, and token planes have no Proxmox rollback primitive, so Proximo doesn't pretend to one.
Several controls are opt-in and inert until configured. CONSENT, CONTAIN, LEASE, SCOPE, ENVELOPE, and TAINT are off unless their env var is set — and they only become a real boundary when their state lives outside your own write reach. Inside a single trust domain they're a discipline, not a wall. The full honesty framing: the two-deployment trust model.
The task list is not the whole truth. Tasks are per-node and pve_tasks_list returns a windowed slice — one node, the limit most-recent. A task on another node or outside your window is absent without being dead. Never conclude a backup failed from its absence there; pve_backup_list / pbs_snapshots_list are the ground truth. (A production agent hit this one for real, and told us through the door below.)
What's still unproven, and where the edges are: honest scope notes.

Read the full file on GitHub · 81 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

2d ago First seen · 81 lines · 1,058 tokens per session scan A a33862c584d6

Subscribe to this mod's changes

proximo AGENTS.md is an instructions file published in the GitHub repository john-broadway/proximo (41 stars, last pushed 3d ago), licensed Apache-2.0. It adds 1,058 tokens to every session, about $0.0053 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Backend and APIs a2a api mcp pbs proxmox pve

proximo AGENTS.md

Getting it into your agent

What it costs to keep this loaded

Grade A, and why

Makes network callslowCapability

How it starts

Hello, agent

What this is — sharp edges first

What this file has done since we first saw it

Other instructions, from other repositories

pvetui AGENTS.md

go-proxmox AGENTS.md

pvetui CLAUDE.md

go-proxmox CLAUDE.md

gitlab-api AGENTS.md

gitlab-api CLAUDE.md